Repository navigation
Support several public hostnames pointing the same Keycloak #44979
Replies: 1 comment 1 reply
You can do that today with the hostname options and realm specific front-end urls. For example: set the front-end url for the mcp-serves realm to auth.public.example.com This is sometimes brought up in the context of supporting multiple front-end urls for a single realm, which is covered in #17634 and several other issues / discussions. |
|
mmmm Could you point me to the right place, please? :) I have been researching a bit more, and the only way I get it is setting: This way it seems to be falling in full-dynamic urls, am I right? Reference: https://www.keycloak.org/server/hostname#_fully_dynamic_urls Just to clarify, my environment is behind a proxy (Istio) and right now everything seems to work, but using xforwarded headers instead of forwarded ones to have full dynamic urls |
Uh oh!
There was an error while loading. Please reload this page.
Description
Keycloak is multi-tenancy but only one domain is possible to be used in front of it. It would be super useful tu support several domains in front, to be able to expose, for example, all the routes in private domains and only some of them for public usage.
The problem now is basically the openid endpoint crafting the URLs based on the hardcoded hostname and not on the hostname just received in the request
Value Proposition
The value for this is high, as it's possible to expose only some paths to public traffic using a public domain, and the rest of admin capabilities (the rest of the realms, admin UI, etc) in private networks, for example:
auth.public.example.com/realms/mcp-servers
auth.private.example.com/*
Goals
Support several hostnames in a way to properly craft the urls in
realms/{realm}/.well-known/openid-configurationand similar well-known endpointsNon-Goals
N/A
Discussion
No response
Notes
Thank you in advance. You are doing a great job
All reactions